Working on a project to reverse-engineer Mail applications changes to keychain files. Using fs_usage I can see # of bytes written to keychain file, but I am unable to determine dynamically exactly what content is being changed